This vulnerability involves insufficient validation of untrusted input in Google Chrome on Android before version 148.0.7778.96. A local attacker can exploit this by crafting a malicious Chrome Extension that injects arbitrary scripts or HTML, leading to a Universal Cross-Site Scripting (UXSS) condition. This could allow script execution in the context of the browser, potentially impacting user security and privacy. The issue is documented as medium severity by Chromium security. No CVSS score or detailed remediation information is currently available from the vendor advisory.

The impact of this vulnerability is the potential for a local attacker to execute arbitrary scripts or HTML within the context of the affected Chrome browser on Android. This could lead to unauthorized actions or data exposure within the browser environment. However, no known exploits have been reported in the wild, and the severity is assessed as medium by Chromium security.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 148.0.7778.96 or later once available. Until then, avoid installing untrusted Chrome Extensions and limit local attacker access to devices.